ShadeCheck: FAIL

{
  "baseline_comparison": {
    "baseline_evidence_root": "c684eadaf0a04e45a283215750f725ef58fc368df9bf58f02f9401b7afc6a15e",
    "baseline_hash": "818770e43d18bfde9bc38829b00352084493e9ceca00c96f3494bff868a6a55b",
    "changes": [
      {
        "behavior": [
          "SC-002",
          "lightwalletd broadcast transport",
          ""
        ],
        "change": "severity-increased",
        "current_severity": "HIGH",
        "previous_severity": "MEDIUM",
        "source_rule": "SC-002"
      }
    ],
    "regressions": 1,
    "resolved_behaviors": [],
    "status": "FAIL",
    "unchanged_behaviors": 1
  },
  "correlation_window_seconds": 30,
  "evidence_modes": [
    "upstream"
  ],
  "evidence_root": "107be3aabb11f4e34e916cbdabf341d0c133dbf4c1d23e5a7bf06c04d3d5e54e",
  "findings": [
    {
      "affected_component": "lightwalletd broadcast transport",
      "evidence": [
        {
          "elapsed_ns": 6686781,
          "event_hash": "c684eadaf0a04e45a283215750f725ef58fc368df9bf58f02f9401b7afc6a15e",
          "metadata": {
            "payload_sha256": "bb0dd7dc6a10a205c05e116e8a321750dd395fd31a23f4124b9633ddac5586f4",
            "payload_size": 2373
          },
          "method": "SendTransaction",
          "mode": "upstream",
          "phase": "request",
          "previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
          "schema_version": 1,
          "sequence": 1,
          "session": "3b2e589b08e3de2fc6a1fab7e3b452b500b3c6060c21856ea16032d4131f8899",
          "timestamp_ns": 1792833768196148034
        },
        {
          "elapsed_ns": 28796040,
          "event_hash": "49ab0d6e38bc0b7b5b9bbfced5dfa56f7a1b82ca60982ad8821e49abb32e6071",
          "metadata": {
            "error_code": 0,
            "request_sequence": 1
          },
          "method": "SendTransaction",
          "mode": "upstream",
          "phase": "response",
          "previous_hash": "c684eadaf0a04e45a283215750f725ef58fc368df9bf58f02f9401b7afc6a15e",
          "schema_version": 1,
          "sequence": 2,
          "session": "3b2e589b08e3de2fc6a1fab7e3b452b500b3c6060c21856ea16032d4131f8899",
          "timestamp_ns": 1792833768218256912
        },
        {
          "elapsed_ns": 136110810,
          "event_hash": "c8cd61880916184250a4902fef189186fbce35769ec4c374553dceea4a040af8",
          "metadata": {
            "height": 0,
            "payload_sha256": "bb0dd7dc6a10a205c05e116e8a321750dd395fd31a23f4124b9633ddac5586f4",
            "payload_size": 2373
          },
          "method": "GetMempoolStream",
          "mode": "upstream",
          "phase": "response",
          "previous_hash": "180b782df8c1c01fd3a46450f4f097c909a5bd8e09361466713e7bc83a15240c",
          "schema_version": 1,
          "sequence": 5,
          "session": "3b2e589b08e3de2fc6a1fab7e3b452b500b3c6060c21856ea16032d4131f8899",
          "timestamp_ns": 1792833768325572254
        }
      ],
      "network_acceptance_reported": true,
      "observed_behavior": "Accepted submission and identical mempool bytes observed within the configured window.",
      "payload_sha256": "bb0dd7dc6a10a205c05e116e8a321750dd395fd31a23f4124b9633ddac5586f4",
      "possible_privacy_consequence": "The RPC observer can associate these submitted bytes with this connection; this does not identify a person.",
      "rule_id": "SC-002",
      "severity": "HIGH",
      "suggested_investigation": "Review the server trust model and whether an independent broadcast path reduces the observer's linkability.",
      "title": "Broadcast payload linked to a transport session"
    },
    {
      "affected_component": "lightwalletd broadcast transport",
      "baseline_evidence": [
        {
          "elapsed_ns": 6686781,
          "event_hash": "c684eadaf0a04e45a283215750f725ef58fc368df9bf58f02f9401b7afc6a15e",
          "metadata": {
            "payload_sha256": "bb0dd7dc6a10a205c05e116e8a321750dd395fd31a23f4124b9633ddac5586f4",
            "payload_size": 2373
          },
          "method": "SendTransaction",
          "mode": "upstream",
          "phase": "request",
          "previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
          "schema_version": 1,
          "sequence": 1,
          "session": "3b2e589b08e3de2fc6a1fab7e3b452b500b3c6060c21856ea16032d4131f8899",
          "timestamp_ns": 1792833768196148034
        }
      ],
      "baseline_evidence_root": "c684eadaf0a04e45a283215750f725ef58fc368df9bf58f02f9401b7afc6a15e",
      "change": {
        "behavior": [
          "SC-002",
          "lightwalletd broadcast transport",
          ""
        ],
        "change": "severity-increased",
        "current_severity": "HIGH",
        "previous_severity": "MEDIUM",
        "source_rule": "SC-002"
      },
      "evidence": [
        {
          "elapsed_ns": 6686781,
          "event_hash": "c684eadaf0a04e45a283215750f725ef58fc368df9bf58f02f9401b7afc6a15e",
          "metadata": {
            "payload_sha256": "bb0dd7dc6a10a205c05e116e8a321750dd395fd31a23f4124b9633ddac5586f4",
            "payload_size": 2373
          },
          "method": "SendTransaction",
          "mode": "upstream",
          "phase": "request",
          "previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
          "schema_version": 1,
          "sequence": 1,
          "session": "3b2e589b08e3de2fc6a1fab7e3b452b500b3c6060c21856ea16032d4131f8899",
          "timestamp_ns": 1792833768196148034
        },
        {
          "elapsed_ns": 28796040,
          "event_hash": "49ab0d6e38bc0b7b5b9bbfced5dfa56f7a1b82ca60982ad8821e49abb32e6071",
          "metadata": {
            "error_code": 0,
            "request_sequence": 1
          },
          "method": "SendTransaction",
          "mode": "upstream",
          "phase": "response",
          "previous_hash": "c684eadaf0a04e45a283215750f725ef58fc368df9bf58f02f9401b7afc6a15e",
          "schema_version": 1,
          "sequence": 2,
          "session": "3b2e589b08e3de2fc6a1fab7e3b452b500b3c6060c21856ea16032d4131f8899",
          "timestamp_ns": 1792833768218256912
        },
        {
          "elapsed_ns": 136110810,
          "event_hash": "c8cd61880916184250a4902fef189186fbce35769ec4c374553dceea4a040af8",
          "metadata": {
            "height": 0,
            "payload_sha256": "bb0dd7dc6a10a205c05e116e8a321750dd395fd31a23f4124b9633ddac5586f4",
            "payload_size": 2373
          },
          "method": "GetMempoolStream",
          "mode": "upstream",
          "phase": "response",
          "previous_hash": "180b782df8c1c01fd3a46450f4f097c909a5bd8e09361466713e7bc83a15240c",
          "schema_version": 1,
          "sequence": 5,
          "session": "3b2e589b08e3de2fc6a1fab7e3b452b500b3c6060c21856ea16032d4131f8899",
          "timestamp_ns": 1792833768325572254
        }
      ],
      "observed_behavior": "Accepted submission and identical mempool bytes observed within the configured window.",
      "possible_privacy_consequence": "A defined privacy-sensitive behavior is newly observed or more severe than the saved baseline.",
      "rule_id": "SC-005",
      "severity": "HIGH",
      "suggested_investigation": "Inspect the current and baseline evidence and the code or configuration change; restore the tested requirement before accepting a new baseline.",
      "title": "Privacy regression: severity-increased"
    }
  ],
  "limitations": [
    "Defined tests cover SC-001 through SC-004; SC-005 requires a compatible saved baseline.",
    "A transport peer identifies a connection, not a person or wallet.",
    "Local fixture replay is not consensus validation or network acceptance.",
    "Transaction SHA-256 fingerprints are not Zcash transaction IDs.",
    "No violation observed does not establish anonymity.",
    "SC-005 compares rule/component/behavior categories, not changing transaction IDs, sessions, timestamps, or finding counts.",
    "Baselines include inspectable evidence; hashes detect editing but do not authenticate an author.",
    "Compatible policy and complete coverage are required; a baseline is not a privacy exemption."
  ],
  "payment_policy": null,
  "policy": "strict",
  "rules": [
    {
      "coverage": "broadcast-observed",
      "covered": true,
      "executed": true,
      "rule_id": "SC-002"
    },
    {
      "coverage": "compatible-baseline-comparison",
      "covered": true,
      "executed": true,
      "rule_id": "SC-005"
    }
  ],
  "schema_version": 1,
  "status": "FAIL",
  "sync_policy": null
}